sproutboat 0.7.0 → 0.8.0

package/src/patch-porffor.ts

@@ -16,20 +16,119 @@ import { readFile, writeFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { porfforRoot } from "./toolchain";
 
-// Splice INJECT in immediately after the opening brace, before the return.
+// Each edit below is independent and idempotent, with its own marker: a file
+// patched by an older version of this file must still receive the newer edits.
 const ANCHOR = "f64 porf_native_fetch_get_port(void) {\n";
-const INJECT =
+
+/** Port from $PORT (the supervisor and `sproutboat dev` set it). */
+const ENV_INJECT =
   '  const char* __sb_port = getenv("PORT");\n' +
   "  if (__sb_port && *__sb_port) { long __sb_v = strtol(__sb_port, NULL, 10); if (__sb_v > 0 && __sb_v < 65536) return (f64)__sb_v; }\n";
-const MARKER = 'getenv("PORT")';
+const ENV_MARKER = 'getenv("PORT")';
+
+// #15 — no `--port` flag: Porffor's native-fetch entry point calls
+// `porf_init(0, NULL)` (see porf_native_fetch_runtime_init in render.js), so a
+// native-fetch binary never sees argv at all. A standalone binary takes its
+// port and data directory from the environment instead, which is what systemd
+// and docker set anyway. Worth an upstream note alongside the $PORT ask.
+
+/**
+ * #15 — let the build add objects to the native-fetch link line.
+ *
+ * Porffor builds `linkArgs` as a fixed array, so an embedded backend that needs
+ * SQLite compiled into the sprout has nowhere to put it. `CXX` is not a way in:
+ * a musl (deploy) build overrides it outright. This splices one spread of
+ * `SB_EXTRA_LINK` before `-lm`, inert unless the variable is set.
+ */
+const LINK_ANCHOR = "          uSocketsArchive,\n          '-lm'\n";
+const LINK_INJECT =
+  "          ...(process.env.SB_EXTRA_LINK ? process.env.SB_EXTRA_LINK.split(' ').filter(Boolean) : []),\n";
+const LINK_MARKER = "SB_EXTRA_LINK";
+
+/**
+ * #15 — and the same for the compile step, so the prelude's inline C can
+ * `#include <bearssl.h>`. The link patch alone is not enough: Porffor compiles
+ * the generated C from stdin with a fixed argument list, so there is otherwise
+ * no way to add an include path.
+ */
+const CFLAGS_ANCHOR = "          '-xc', '-', '-c',\n";
+const CFLAGS_INJECT =
+  "          ...(process.env.SB_EXTRA_CFLAGS ? process.env.SB_EXTRA_CFLAGS.split(' ').filter(Boolean) : []),\n";
+const CFLAGS_MARKER = "SB_EXTRA_CFLAGS";
+
+/**
+ * #56 — make the inbound request-body limit configurable.
+ *
+ * Porffor's uWebSockets shim hardcodes 1 MiB and answers anything larger with a
+ * bare `413 request body too large` before the handler runs, so a project can
+ * neither accept a bigger upload nor say anything useful about the refusal.
+ *
+ * The default stays 1 MiB: a larger body is held in memory whole, so raising it
+ * is a decision about this deployment's memory, not something to inherit.
+ */
+const BODY_ANCHOR = "static const size_t REQUEST_BODY_MAX_BYTES = 1024u * 1024u;";
+const BODY_INJECT = `static size_t sb_request_body_max(void) {
+  static size_t cached = 0;
+  if (cached == 0) {
+    const char* raw = getenv("SB_REQUEST_BODY_MAX");
+    long parsed = raw && *raw ? atol(raw) : 0;
+    cached = parsed > 0 ? (size_t)parsed : 1024u * 1024u;
+  }
+  return cached;
+}
+#define REQUEST_BODY_MAX_BYTES sb_request_body_max()`;
+const BODY_MARKER = "sb_request_body_max";
 
 let done = false;
 
+/** The uWebSockets shim source, which is where the body limit lives. */
+async function patchBodyLimit(): Promise<void> {
+  const file = resolve(porfforRoot(), "compiler/uwebsockets.js");
+  const src = await readFile(file, "utf8");
+  if (src.includes(BODY_MARKER)) return;
+  if (!src.includes(BODY_ANCHOR)) {
+    throw new Error(
+      `could not patch Porffor's request body limit: anchor not found in ${file}. ` +
+        "Porffor's uWebSockets shim changed — check patches/UPSTREAM.md.",
+    );
+  }
+  await writeFile(file, src.replace(BODY_ANCHOR, BODY_INJECT));
+}
+
+async function patchCompilerArgs(): Promise<void> {
+  const file = resolve(porfforRoot(), "compiler/index.js");
+  let src = await readFile(file, "utf8");
+  let changed = false;
+  for (const [marker, anchor, inject, what] of [
+    [LINK_MARKER, LINK_ANCHOR, LINK_INJECT, "extra link args"],
+    [CFLAGS_MARKER, CFLAGS_ANCHOR, CFLAGS_INJECT, "extra compiler flags"],
+  ] as const) {
+    if (src.includes(marker)) continue;
+    const at = src.indexOf(anchor);
+    if (at === -1) {
+      throw new Error(
+        `could not patch Porffor for ${what}: anchor not found in ${file}. ` +
+          "Porffor's native-fetch build changed — check patches/UPSTREAM.md.",
+      );
+    }
+    // After the anchor for cflags (the args follow it), before it for the link
+    // line (the object list ends with it).
+    src =
+      marker === CFLAGS_MARKER
+        ? src.slice(0, at + anchor.length) + inject + src.slice(at + anchor.length)
+        : src.slice(0, at) + inject + src.slice(at);
+    changed = true;
+  }
+  if (changed) await writeFile(file, src);
+}
+
 export async function ensurePorfforPatched(): Promise<void> {
   if (done) return;
+  await patchCompilerArgs();
+  await patchBodyLimit();
   const file = resolve(porfforRoot(), "compiler/render.js");
   const src = await readFile(file, "utf8");
-  if (src.includes(MARKER)) {
+  if (src.includes(ENV_MARKER)) {
     done = true;
     return;
   }
@@ -40,7 +139,6 @@ export async function ensurePorfforPatched(): Promise<void> {
         "Porffor's native-fetch renderer changed — check patches/UPSTREAM.md.",
     );
   }
-  const patched = src.slice(0, anchorAt + ANCHOR.length) + INJECT + src.slice(anchorAt + ANCHOR.length);
-  await writeFile(file, patched);
+  await writeFile(file, src.slice(0, anchorAt + ANCHOR.length) + ENV_INJECT + src.slice(anchorAt + ANCHOR.length));
   done = true;
 }

package/src/sqlite.ts

@@ -0,0 +1,99 @@
+/**
+ * #15 — the SQLite object an embedded-backend sprout links against.
+ *
+ * Built once and cached: the amalgamation is a single 9 MB C file that takes
+ * ~10s to compile, which is fine once per toolchain and intolerable per build.
+ * Cached beside the Zig toolchain, keyed by version + target, so switching
+ * targets or bumping SQLite cannot silently reuse the wrong object.
+ *
+ * The amalgamation is downloaded rather than vendored: 9 MB of third-party C in
+ * the repo would dwarf the CLI, and the checksum below is what makes the
+ * download safe to trust.
+ */
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { homedir } from "node:os";
+
+export const SQLITE_VERSION = "3.50.4";
+
+/** Same cache root Zig uses, so one `rm -rf ~/.cache/sproutboat` clears everything. */
+const cacheDir = (): string => resolve(homedir(), ".cache/sproutboat", `sqlite-${SQLITE_VERSION}`);
+const SQLITE_ZIP = `https://sqlite.org/2025/sqlite-amalgamation-3500400.zip`;
+const SQLITE_SHA256 = "1d3049dd0f830a025a53105fc79fd2ab9431aea99e137809d064d8ee8356b032";
+
+/**
+ * Compile flags. THREADSAFE=0 because a sprout serves one turn at a time;
+ * DQS=0 rejects double-quoted string literals, which is the setting that turns
+ * a typo'd column name in user SQL into an error instead of a string.
+ */
+const SQLITE_DEFINES = [
+  "-DSQLITE_THREADSAFE=0",
+  "-DSQLITE_OMIT_LOAD_EXTENSION",
+  "-DSQLITE_DQS=0",
+  "-DSQLITE_DEFAULT_MEMSTATUS=0",
+  "-DSQLITE_OMIT_DEPRECATED",
+  "-DSQLITE_DEFAULT_WAL_SYNCHRONOUS=1",
+];
+
+const run = (cmd: string, args: string[]): Promise<{ code: number; stderr: string }> =>
+  new Promise((done) => {
+    const child = spawn(cmd, args, { stdio: ["ignore", "ignore", "pipe"] });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => (stderr += String(chunk)));
+    child.on("close", (code) => done({ code: code ?? 1, stderr }));
+  });
+
+async function amalgamation(): Promise<string> {
+  const dir = cacheDir();
+  const source = resolve(dir, "sqlite3.c");
+  if (existsSync(source)) return source;
+  await mkdir(dir, { recursive: true });
+
+  const response = await fetch(SQLITE_ZIP);
+  if (!response.ok) throw new Error(`could not download SQLite ${SQLITE_VERSION}: HTTP ${response.status}`);
+  const zip = Buffer.from(await response.arrayBuffer());
+  const digest = createHash("sha256").update(zip).digest("hex");
+  if (digest !== SQLITE_SHA256) {
+    throw new Error(`SQLite amalgamation checksum mismatch: expected ${SQLITE_SHA256}, got ${digest}`);
+  }
+  const zipPath = resolve(dir, "amalgamation.zip");
+  await writeFile(zipPath, zip);
+  const unzip = await run("unzip", ["-oqj", zipPath, "-d", dir]);
+  if (unzip.code !== 0) throw new Error(`could not unpack the SQLite amalgamation: ${unzip.stderr}`);
+  if (!existsSync(source)) throw new Error("the SQLite amalgamation did not contain sqlite3.c");
+  return source;
+}
+
+export type SqliteObjectInput = {
+  /** `host` compiles with cc; `linux-x86_64` cross-compiles with the pinned Zig. */
+  target: "linux-x86_64" | "host";
+  /** Zig binary, required for the linux target. */
+  zigBin?: string;
+};
+
+/** Path to `sqlite3.o` for this target, building it on first use. */
+export async function ensureSqliteObject(input: SqliteObjectInput): Promise<string> {
+  const dir = cacheDir();
+  const objectPath = resolve(dir, `sqlite3-${input.target}.o`);
+  if (existsSync(objectPath)) return objectPath;
+
+  const source = await amalgamation();
+  const [cmd, prefix] =
+    input.target === "host"
+      ? (["cc", []] as const)
+      : ([input.zigBin ?? "zig", ["cc", "-target", "x86_64-linux-musl"]] as const);
+  const result = await run(cmd, [...prefix, "-c", source, "-o", objectPath, "-O2", ...SQLITE_DEFINES]);
+  if (result.code !== 0) throw new Error(`could not compile SQLite for ${input.target}:\n${result.stderr}`);
+  return objectPath;
+}
+
+/** The SQLite build stamp, for the artifact manifest's provenance string. */
+export const sqliteStamp = (): string => `sqlite/${SQLITE_VERSION}`;
+
+/** Read back the compiled object's size, for reporting. */
+export async function sqliteObjectSize(path: string): Promise<number> {
+  return (await readFile(path)).byteLength;
+}

package/src/standalone-build.ts

@@ -0,0 +1,64 @@
+/**
+ * #15 — `sproutboat build --standalone`.
+ *
+ * Emits ONE executable carrying the compiled sprout, its static assets and its
+ * binding declarations, with SQLite linked in so there is no broker and no
+ * second process. The build is thin on purpose: `buildArtifact` with the
+ * embedded transport already produces exactly the binary we want, so this
+ * copies it out and enforces the one thing a standalone binary cannot do.
+ */
+import { chmod, cp, mkdir, readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { buildArtifact, type BuildInput } from "./build";
+import type { Bindings } from "./wrap";
+
+export type StandaloneBuildInput = BuildInput & {
+  /** Where to write the executable. Defaults to `<projectDir>/dist/<name>`. */
+  outPath?: string;
+};
+
+export type StandaloneBuildResult = { outPath: string; bytes: number };
+
+/**
+ * Bindings a standalone binary cannot serve.
+ *
+ * A build error, not a runtime no-op: a binary whose binding silently does
+ * nothing is discovered in production, on a device someone has to reach
+ * physically.
+ *
+ * Outbound `fetch` is absent from this list: http and https both work, with
+ * BearSSL and the Mozilla root set compiled in.
+ */
+export function unsupportedBindings(bindings: Partial<Bindings>): string[] {
+  const reasons: string[] = [];
+  if ((bindings.services ?? []).length > 0) {
+    reasons.push("service bindings call another deployment through an edge, which a standalone binary has none of");
+  }
+  return reasons;
+}
+
+export async function buildStandalone(input: StandaloneBuildInput): Promise<StandaloneBuildResult> {
+  const artifact = await buildArtifact({ ...input, transport: "embedded" });
+
+  let bindings: Partial<Bindings> = {};
+  try {
+    // SAFETY: bindings.json is written by buildArtifact from the validated
+    // config in this same call — our own output, not user input.
+    bindings = JSON.parse(await readFile(resolve(artifact.artifactDir, "bindings.json"), "utf8")) as Partial<Bindings>;
+  } catch {
+    bindings = {}; // a project with no bindings at all
+  }
+
+  const blocked = unsupportedBindings(bindings);
+  if (blocked.length > 0) {
+    throw new Error(`cannot build a standalone binary for this project:\n  - ${blocked.join("\n  - ")}`);
+  }
+
+  // The sprout *is* the binary: assets and bindings are compiled into it, and
+  // everything else it needs (port, data dir, secrets) arrives at run time.
+  const outPath = input.outPath ?? resolve(input.projectDir, "dist", input.config.name);
+  await mkdir(resolve(outPath, ".."), { recursive: true });
+  await cp(resolve(artifact.artifactDir, "sprout"), outPath);
+  await chmod(outPath, 0o755);
+  return { outPath, bytes: Bun.file(outPath).size };
+}

package/src/surface.ts

@@ -89,10 +89,10 @@ export const COMMANDS: readonly Command[] = [
     name: "build",
     group: "Develop",
     emoji: "🔨",
-    args: "[project-dir] [--target host]",
+    args: "[project-dir] [--target host] [--standalone]",
     brief: "[project-dir]",
     summary:
-      "Cross-compile the native-fetch sprout (Porffor + Zig). `--target host` builds for this machine instead, to run locally — not deployable.",
+      "Cross-compile the native-fetch sprout (Porffor + Zig). `--target host` builds for this machine instead, to run locally — not deployable. `--standalone` emits one executable carrying its own bindings, with SQLite compiled in (~2 MB) and no broker process.",
   },
 
   {
@@ -228,6 +228,41 @@ export const ENV_VARS: readonly EnvVar[] = [
     purpose:
       "http://127.0.0.1:<PORT> of the sprout; when set, `src/broker.ts` runs the cron scheduler and queue consumer and delivers triggers to it.",
   },
+  {
+    name: "SB_DATA_DIR",
+    purpose:
+      "Where a standalone binary keeps store.sqlite and d1/ (#15). Read by the sprout itself in an embedded build; defaults to ./<name>.data.",
+  },
+  {
+    name: "SPROUTBOAT_DATA",
+    purpose:
+      "Data directory for a standalone binary, after --data and SB_DATA_DIR, before the ./<name>.data default (#15).",
+  },
+  {
+    name: "SB_CA_BUNDLE",
+    purpose:
+      "PEM bundle of extra certificate authorities a standalone binary should trust, on top of the compiled-in Mozilla root set (#15). Adds trust; nothing disables verification.",
+  },
+  {
+    name: "SB_FETCH_MAX_BYTES",
+    purpose:
+      "Largest outbound `fetch()` response body a sprout will read, in bytes (default 33554432). The size is the remote host's choice and the body is held whole, so this is the ceiling that stops one upstream exhausting memory.",
+  },
+  {
+    name: "SB_REQUEST_BODY_MAX",
+    purpose:
+      "Largest inbound request body the runtime accepts, in bytes (default 1048576). Anything larger is refused with 413 before the handler runs.",
+  },
+  {
+    name: "SB_EXTRA_CFLAGS",
+    purpose:
+      "Flags added to Porffor's native-fetch compile step, set by the build so inline C can include BearSSL's header (#15).",
+  },
+  {
+    name: "SB_EXTRA_LINK",
+    purpose:
+      "Objects to add to Porffor's native-fetch link line, set by the build so a standalone binary links SQLite and BearSSL (#15).",
+  },
 ];
 
 const GROUP_ORDER: readonly Group[] = ["Develop", "Ship", "Storage", "Configure", "Account"];

package/src/transport-broker.js

@@ -0,0 +1,290 @@
+/**
+ * The broker transport: one long-lived loopback connection to the per-deployment
+ * binding broker, `[u32 LE length][payload]` frames both ways.
+ *
+ * This is what a deployed sprout uses, and what `sproutboat dev` and a phase-0
+ * standalone binary use. The embedded transport (transport-embedded.js) is the
+ * same `__sbCall(reqJson) -> replyJson` contract with SQLite compiled in
+ * instead of a broker on the other end — everything above __sbCall is shared.
+ */
+// SB_BROKER_PORT / SB_BROKER_TOKEN are set by the supervisor next to $PORT.
+// If SB_BROKER_PORT is unset the shims below are never installed (compile.ts
+// only emits the __sbInstallBindings call when the project declares bindings),
+// so a plain sprout is byte-for-byte unchanged.
+// ponytail: text values only; still AF_INET loopback, not AF_UNIX. A failed
+// exchange reconnects and resends once — a broker crash between "request applied"
+// and "reply read" can double-apply a non-idempotent op (queue.send, INSERT);
+// the old fresh-connection-per-call path just failed the call there instead.
+// Binary values + AF_UNIX = v2.
+
+// oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+Porffor.c`
+static int sb_io_all(int fd, unsigned char* buf, size_t len, int writing) {
+  size_t done = 0;
+  while (done < len) {
+    long n = writing ? write(fd, buf + done, len - done) : read(fd, buf + done, len - done);
+    if (n <= 0) {
+      if (n < 0 && errno == EINTR) continue;
+      return -1;
+    }
+    done += (size_t)n;
+  }
+  return 0;
+}
+
+// One long-lived loopback connection to the broker, reused across every binding
+// call. The broker frames each request/reply independently and keeps the socket
+// open, so the steady-state per-call cost is just write + read — no socket(),
+// connect() handshake or close() each time. -1 = not connected.
+static int sb_broker_fd = -1;
+
+static int sb_broker_connect(void) {
+  const char* port_s = getenv("SB_BROKER_PORT");
+  if (!port_s) return -10;
+  signal(SIGPIPE, SIG_IGN); // a dead broker must yield EPIPE, not kill the sprout
+  int fd = socket(AF_INET, SOCK_STREAM, 0);
+  if (fd < 0) return -1;
+  int one = 1;
+  setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+  struct sockaddr_in addr;
+  memset(&addr, 0, sizeof(addr));
+  addr.sin_family = AF_INET;
+  addr.sin_port = htons((unsigned short)atoi(port_s));
+  addr.sin_addr.s_addr = htonl(0x7f000001u); // 127.0.0.1
+  if (connect(fd, (struct sockaddr*)&addr, sizeof(addr)) != 0) { close(fd); return -2; }
+  sb_broker_fd = fd;
+  return 0;
+}
+
+// Send one framed request, read one framed reply, on the persistent fd.
+// Send one payload verbatim and read one reply. The caller owns the payload's
+// shape: a v0 exchange prepends the token line, a v1 one carries the token in
+// its JSON and must reach the broker byte for byte — prefixing it would leave
+// the marker in the wrong place and the frame would read as v0.
+static int sb_broker_exchange_raw(const char* body, size_t body_len, char** resp_out, size_t* resp_len_out) {
+  unsigned char* frame = (unsigned char*)malloc(4 + body_len);
+  if (!frame) return -5;
+  frame[0] = (unsigned char)(body_len & 0xff);
+  frame[1] = (unsigned char)((body_len >> 8) & 0xff);
+  frame[2] = (unsigned char)((body_len >> 16) & 0xff);
+  frame[3] = (unsigned char)((body_len >> 24) & 0xff);
+  if (body_len) memcpy(frame + 4, body, body_len);
+  int wr = sb_io_all(sb_broker_fd, frame, 4 + body_len, 1);
+  free(frame);
+  if (wr != 0) return -3;
+
+  unsigned char rhdr[4];
+  if (sb_io_all(sb_broker_fd, rhdr, 4, 0) != 0) return -4;
+  size_t rlen = (size_t)rhdr[0] | ((size_t)rhdr[1] << 8) | ((size_t)rhdr[2] << 16) | ((size_t)rhdr[3] << 24);
+
+  char* buf = (char*)malloc(rlen ? rlen : 1);
+  if (!buf) return -5;
+  if (rlen && sb_io_all(sb_broker_fd, (unsigned char*)buf, rlen, 0) != 0) { free(buf); return -6; }
+
+  *resp_out = buf;
+  *resp_len_out = rlen;
+  return 0;
+}
+
+// #63 — the binary reply from the last v1 exchange, handed to JS on request.
+// Stashed rather than returned inline so an 8 MB object body is one allocation
+// in the Porffor heap, not a substring of a bigger one.
+static char* sb_bin_reply = 0;
+static size_t sb_bin_reply_len = 0;
+
+// v0: token line, then the JSON.
+static int sb_broker_exchange(const char* req, size_t req_len, char** resp_out, size_t* resp_len_out) {
+  const char* tok = getenv("SB_BROKER_TOKEN");
+  size_t tok_len = tok ? strlen(tok) : 0;
+  size_t body_len = tok_len + 1 + req_len;
+  char* body = (char*)malloc(body_len);
+  if (!body) return -5;
+  if (tok_len) memcpy(body, tok, tok_len);
+  body[tok_len] = '\n';
+  if (req_len) memcpy(body + tok_len + 1, req, req_len);
+  int rc = sb_broker_exchange_raw(body, body_len, resp_out, resp_len_out);
+  free(body);
+  return rc;
+}
+
+// Backoff between attempts: 0, 5, 25, then 100 ms.
+static void sb_backoff(int attempt) {
+  static const long ms[4] = { 0, 5, 25, 100 };
+  long wait = ms[attempt < 4 ? attempt : 3];
+  if (wait <= 0) return;
+  struct timespec ts;
+  ts.tv_sec = wait / 1000;
+  ts.tv_nsec = (wait % 1000) * 1000000L;
+  nanosleep(&ts, 0);
+}
+
+static int sb_broker_roundtrip(const char* req, size_t req_len, char** resp_out, size_t* resp_len_out) {
+  *resp_out = NULL;
+  *resp_len_out = 0;
+  // Four tries with backoff. One retry was tuned for "systemd restarted it in
+  // 20 ms"; a broker being upgraded, or a shared one restarting, is every
+  // deployment's binding calls failing inside that window. Retrying the same
+  // bytes is safe because each request carries an id the broker deduplicates.
+  int rc = -3;
+  for (int attempt = 0; attempt < 4; attempt++) {
+    sb_backoff(attempt);
+    if (sb_broker_fd < 0) {
+      int c = sb_broker_connect();
+      if (c != 0) { rc = c; continue; }
+    }
+    rc = sb_broker_exchange(req, req_len, resp_out, resp_len_out);
+    if (rc == 0) return 0;
+    close(sb_broker_fd);
+    sb_broker_fd = -1;
+  }
+  return rc;
+}
+
+// A v1 exchange: marker, json length, json, then the body bytes. The reply is
+// split the same way, its JSON returned and its bytes stashed for __sbTakeBin.
+static int sb_broker_roundtrip_v1(const char* json, size_t json_len, const char* body, size_t body_len,
+                                  char** resp_out, size_t* resp_len_out) {
+  size_t req_len = 1 + 4 + json_len + body_len;
+  char* req = (char*)malloc(req_len);
+  if (!req) return -4;
+  req[0] = 1;
+  unsigned int jl = (unsigned int)json_len;
+  memcpy(req + 1, &jl, 4);
+  memcpy(req + 5, json, json_len);
+  if (body_len) memcpy(req + 5 + json_len, body, body_len);
+
+  char* resp = 0; size_t resp_len = 0;
+  int rc = -3;
+  for (int attempt = 0; attempt < 4; attempt++) {
+    sb_backoff(attempt);
+    if (sb_broker_fd < 0) {
+      int c = sb_broker_connect();
+      if (c != 0) { rc = c; continue; }
+    }
+    rc = sb_broker_exchange_raw(req, req_len, &resp, &resp_len);
+    if (rc == 0) break;
+    close(sb_broker_fd);
+    sb_broker_fd = -1;
+  }
+  free(req);
+  if (rc != 0) return rc;
+
+  if (sb_bin_reply) { free(sb_bin_reply); sb_bin_reply = 0; sb_bin_reply_len = 0; }
+  if (resp_len >= 5 && (unsigned char)resp[0] == 1) {
+    unsigned int rjl = 0;
+    memcpy(&rjl, resp + 1, 4);
+    if (5 + (size_t)rjl <= resp_len) {
+      size_t bin_len = resp_len - 5 - rjl;
+      if (bin_len) {
+        sb_bin_reply = (char*)malloc(bin_len);
+        if (sb_bin_reply) { memcpy(sb_bin_reply, resp + 5 + rjl, bin_len); sb_bin_reply_len = bin_len; }
+      }
+      char* json_only = (char*)malloc(rjl + 1);
+      if (!json_only) { free(resp); return -4; }
+      memcpy(json_only, resp + 5, rjl);
+      json_only[rjl] = 0;
+      free(resp);
+      *resp_out = json_only;
+      *resp_len_out = rjl;
+      return 0;
+    }
+  }
+  // A broker that answered v0 to a v1 request predates this: pass its reply
+  // through so the error it wrote is what the handler sees.
+  *resp_out = resp;
+  *resp_len_out = resp_len;
+  return 0;
+}
+`;
+
+// One request string in, one reply string out. `reqJson` is a parameter, so the
+// generated C names it directly in the RawC block below.
+// oxlint-disable-next-line no-unused-vars -- `reqJson` is read inside the RawC block below, not by JS.
+function __sbCall(reqJson) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __req; size_t __reqlen; char* __reqowned = 0;
+    porf_native_fetch_read_value(reqJson, &__req, &__reqlen, &__reqowned);
+    char* __resp = 0; size_t __resplen = 0;
+    int __rc = sb_broker_roundtrip(__req, __reqlen, &__resp, &__resplen);
+    if (__reqowned) free(__reqowned);
+    if (__rc == 0) {
+      res = porf_box((f64)porf_native_fetch_alloc_bytestring(__resp, __resplen), 195);
+      free(__resp);
+    } else {
+      char __e[40];
+      int __n = snprintf(__e, sizeof(__e), "{\"ok\":false,\"error\":\"broker rc %d\"}", __rc);
+      res = porf_box((f64)porf_native_fetch_alloc_bytestring(__e, (size_t)__n), 195);
+    }
+  `;
+  return res;
+}
+
+/**
+ * No-op: a deployed sprout's cron ticks, queue batches and DO alarms are
+ * delivered by the broker over x-sb-trigger. The embedded transport defines the
+ * real one, so the generated module can call this unconditionally.
+ */
+globalThis.__sbStartLocalTriggers = function () {};
+
+// #63 — a v1 exchange carrying a body. Returns the reply JSON; any bytes in the
+// reply wait in __sbTakeBin.
+// oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
+function __sbCallBin(reqJson, body) {
+  let res = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    const char* __j; size_t __jl; char* __jo = 0;
+    porf_native_fetch_read_value(reqJson, &__j, &__jl, &__jo);
+    const char* __b; size_t __bl; char* __bo = 0;
+    porf_native_fetch_read_value(body, &__b, &__bl, &__bo);
+    char* __resp = 0; size_t __resplen = 0;
+    int __rc = sb_broker_roundtrip_v1(__j, __jl, __b, __bl, &__resp, &__resplen);
+    if (__jo) free(__jo);
+    if (__bo) free(__bo);
+    if (__rc == 0) {
+      res = porf_box((f64)porf_native_fetch_alloc_bytestring(__resp, __resplen), 195);
+      free(__resp);
+    } else {
+      char __e[40];
+      int __n = snprintf(__e, sizeof(__e), "{\"ok\":false,\"error\":\"broker rc %d\"}", __rc);
+      res = porf_box((f64)porf_native_fetch_alloc_bytestring(__e, (size_t)__n), 195);
+    }
+  `;
+  return res;
+}
+
+/** The bytes from the last v1 reply, if it carried any. Clears the stash. */
+function __sbTakeBin() {
+  let out = "";
+  // oxlint-disable-next-line no-unused-expressions -- Porffor.c`...` is inline C the compiler consumes, not a JS expression.
+  Porffor.c`
+    if (sb_bin_reply && sb_bin_reply_len) {
+      out = porf_box((f64)porf_native_fetch_alloc_bytestring(sb_bin_reply, sb_bin_reply_len), 195);
+    }
+    if (sb_bin_reply) { free(sb_bin_reply); sb_bin_reply = 0; sb_bin_reply_len = 0; }
+  `;
+  return out;
+}
+
+/** #63 — R2 bodies as bytes rather than escaped into the frame. */
+globalThis.__sbR2Put = function (bucket, key, body, httpMetadata, customMetadata) {
+  const token = __sbEnv("SB_BROKER_TOKEN");
+  const reply = JSON.parse(
+    __sbCallBin(
+      JSON.stringify({ v: 1, token, op: "r2.put", bucket, key, httpMetadata, customMetadata }),
+      body == null ? "" : String(body),
+    ),
+  );
+  if (reply.ok === false) throw new Error("sproutboat r2.put: " + (reply.error || "failed"));
+  return reply;
+};
+
+globalThis.__sbR2Get = function (bucket, key) {
+  const token = __sbEnv("SB_BROKER_TOKEN");
+  const reply = JSON.parse(__sbCallBin(JSON.stringify({ v: 1, token, op: "r2.get", bucket, key }), ""));
+  if (reply.ok === false) throw new Error("sproutboat r2.get: " + (reply.error || "failed"));
+  if (!reply.found) return { found: false };
+  return { found: true, object: reply.object, body: __sbTakeBin() };
+};